es_events_t

Declaration

struct es_events_t

Overview

Each event monitored by Endpoint Security delivers different properties to clients. For example, a file-renaming event provides source and target paths, while a process-forking event provides the process identifier of the new child process. This C union represents each kind of event as a unique member, each with a type specific to the kind of data it contains.

Topics

File-System Events

• access
• clone
• copyfile
• close
• create
• dup
• exchangedata
• fcntl
• open
• rename
• write
• truncate
• lookup
• searchfs

File Metadata Events

• deleteextattr
• fsgetpath
• getattrlist
• getextattr
• listextattr
• readdir
• setacl
• setattrlist
• setextattr
• setflags
• setmode
• setowner
• stat
• utimes

File Provider Events

• file_provider_materialize
• file_provider_update

Symbolic Link Events

• link
• readlink
• unlink

File System Mounting Events

• mount
• unmount
• remount

Memory Mapping Events

• mmap
• mprotect

Process Events

• chdir
• chroot
• exec
• fork
• proc_check
• signal
• exit

Interprocess Events

• proc_suspend_resume
• trace
• remote_thread_create

Task Port Events

• get_task
• get_task_read
• get_task_inspect
• get_task_name

User and Group ID Events

• setuid
• setgid
• seteuid
• setegid
• setreuid
• setregid

Code Signing Events

• cs_invalidated

Socket Events

• uipc_bind
• uipc_connect

Clock Events

• settime

Kernel Events

• iokit_open
• kextload
• kextunload

Pseudoterminal Events

• pty_close
• pty_grant

Initializers

• init(access:)
• init(authentication:)
• init(authorization_judgement:)
• init(authorization_petition:)
• init(btm_launch_item_add:)
• init(btm_launch_item_remove:)
• init(chdir:)
• init(chroot:)
• init(clone:)
• init(close:)
• init(copyfile:)
• init(create:)
• init(cs_invalidated:)
• init(deleteextattr:)
• init(dup:)
• init(exchangedata:)
• init(exec:)
• init(exit:)
• init(fcntl:)
• init(file_provider_materialize:)
• init(file_provider_update:)
• init(fork:)
• init(fsgetpath:)
• init(gatekeeper_user_override:)
• init(get_task:)
• init(get_task_inspect:)
• init(get_task_name:)
• init(get_task_read:)
• init(getattrlist:)
• init(getextattr:)
• init(iokit_open:)
• init(kextload:)
• init(kextunload:)
• init(link:)
• init(listextattr:)
• init(login_login:)
• init(login_logout:)
• init(lookup:)
• init(lw_session_lock:)
• init(lw_session_login:)
• init(lw_session_logout:)
• init(lw_session_unlock:)
• init(mmap:)
• init(mount:)
• init(mprotect:)
• init(od_attribute_set:)
• init(od_attribute_value_add:)
• init(od_attribute_value_remove:)
• init(od_create_group:)
• init(od_create_user:)
• init(od_delete_group:)
• init(od_delete_user:)
• init(od_disable_user:)
• init(od_enable_user:)
• init(od_group_add:)
• init(od_group_remove:)
• init(od_group_set:)
• init(od_modify_password:)
• init(open:)
• init(openssh_login:)
• init(openssh_logout:)
• init(proc_check:)
• init(proc_suspend_resume:)
• init(profile_add:)
• init(profile_remove:)
• init(pty_close:)
• init(pty_grant:)
• init(readdir:)
• init(readlink:)
• init(remote_thread_create:)
• init(remount:)
• init(rename:)
• init(screensharing_attach:)
• init(screensharing_detach:)
• init(searchfs:)
• init(setacl:)
• init(setattrlist:)
• init(setegid:)
• init(seteuid:)
• init(setextattr:)
• init(setflags:)
• init(setgid:)
• init(setmode:)
• init(setowner:)
• init(setregid:)
• init(setreuid:)
• init(settime:)
• init(setuid:)
• init(signal:)
• init(stat:)
• init(su:)
• init(sudo:)
• init(tcc_modify:)
• init(trace:)
• init(truncate:)
• init(uipc_bind:)
• init(uipc_connect:)
• init(unlink:)
• init(unmount:)
• init(utimes:)
• init(write:)
• init(xp_malware_detected:)
• init(xp_malware_remediated:)
• init(xpc_connect:)

Instance Properties

• authentication
• authorization_judgement
• authorization_petition
• btm_launch_item_add
• btm_launch_item_remove
• gatekeeper_user_override
• login_login
• login_logout
• lw_session_lock
• lw_session_login
• lw_session_logout
• lw_session_unlock
• od_attribute_set
• od_attribute_value_add
• od_attribute_value_remove
• od_create_group
• od_create_user
• od_delete_group
• od_delete_user
• od_disable_user
• od_enable_user
• od_group_add
• od_group_remove
• od_group_set
• od_modify_password
• openssh_login
• openssh_logout
• profile_add
• profile_remove
• screensharing_attach
• screensharing_detach
• su
• sudo
• tcc_modify
• xp_malware_detected
• xp_malware_remediated
• xpc_connect

Relationships

Conforms To

• Sendable

See Also

Identifying the Matched Event

• event
• event_type
• es_event_type_t